---
title: Login
---

To interact securely with the `nanoctl` CLI, users must authenticate using one of the supported methods. Depending on your use case—whether it's CI/CD automation, local development, or quick testing—`nanoctl` offers flexible authentication options to suit your workflow. Each method supports the use of API tokens, with varying levels of interactivity, security, and persistence:

* **Environment Variable**: Ideal for headless or automated environments.
* **Token Flag**: Useful for short-lived sessions or scripting.
* **Interactive Prompt**: Designed for secure, user-friendly local authentication with token storage.

Choose the method that best aligns with your development or deployment context.

## Authentication Methods

### 1. Environment Variable
   - **Best for**: Automated environments, CI/CD pipelines

        **Usage**:
        ```bash
        export NANOSERVICES_TOKEN="your_api_token_here"
        npx nanoctl@latest login
        ```

        **Behavior**:
        - Automatically detects `NANOSERVICES_TOKEN` from the environment.
        - Non-interactive - runs silently.
        - Returns exit code `0` on success, non-zero on failure.
        - Token is not stored locally (uses the environment variable each time).
        
### 2. Token Flag
   - **Best for**: Temporary sessions, quick testing

        **Usage**:
        ```bash
        npx nanoctl@latest login --token "your_api_token_here"
        npx nanoctl@latest login -t "your_api_token_here"
        ```

        **Behavior**:
        - Immediately authenticates with the provided token.
        - Token is not saved to disk.
        - Shows authentication result message.
        - Recommended to wrap the token in quotes to prevent shell history logging.

### 3. Interactive Prompt
  - **Best for**: First-time setup, most secure local use
    **Usage**:
    ```bash
    npx nanoctl@latest login
    ```

    **Interactive Flow**:
    - **Command launches prompt**:
    ```bash
    ◆ Please provide the token for authentication. You can create it on https://atomic.deskree.com/auth/access/token █
    ```
    Input is masked while typing.
    - **Token is validated immediately**:
        - **On success**:
            - Token is encrypted and stored.
            - Displays welcome message with username and expiration date.
        - **On failure**:
            - Shows specific error (e.g., invalid token, network issue).

## How to Log Out

To remove the stored authentication token and end the session, run:

```bash
npx nanoctl@latest logout
```

This command deletes the locally saved token, ensuring that future `nanoctl` operations require re-authentication. It's a recommended practice when switching users or revoking access on a shared environment.
